Access-list for MAC addresses

[gilson_machado]

Does anyone have a sample of access-list for allow a specific MAC address to access the network? In order words, something like:"access-list permit [MAC address]" It is for a simple PC only.

Thanks

[Georg Pauwen]

Hello,

you could use a 48-bit extended MAC address access list. Here is an example:

access-list 701 permit 000C.E66B.0DE7 0000.0000.0000

To apply the access list to an interface, type:

interface ethernet 0

access-expression input smac(701)

Which platform are you using ? AFAIK, MAC address filtering is not supported on the e.g. 800 Series routers...

Regards,

GP

[gilson_machado]

Thanks, I am using Cisco 1721 with IOS 12.2(4). The main goal is to let only few MAC adresses to access network services. Or to limited few devices to get IP addresses from DHCP. Do you think the sample you send me work for this purpose?

Do you know where I can find a documentation about that on CCO ?

Thanks

Gilson

[thisisshanky]

Dont remember where I read this, but I think mac-address based ACLs work only on non IP traffic (like DLSW).

If the number of PCs are very less in number, it would be much better to do a hardware based reservation for each mac-address of the PC. Exclude any address beyond the ones that are allocated. This would ensure that nobody else gets an IP address. Also you might want to do 802.1x based auth. on the switch, so that no body comes and plug their PC/laptop to any switchport and start accessing the network.

[gilson_machado]

Thanks for the information.

I have the above ACL configured and I will be testing it tomorrow. this is a remote site and I have a HUB connected to the router.

I liked the idea of have it restricted in the DHCP so I will be implementing it.

I will give a feedback tomorrow about the test.